Vulnerability Description
An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup endpoint (`index.php/admin/update/sa/backup`), allowing attackers to specify arbitrary file paths using a crafted `datasupdateinfo` payload. The files are packaged in a ZIP archive and made available for download without authentication. This vulnerability can be exploited to read arbitrary files on the host system, including sensitive OS and configuration files.
Related Weaknesses (CWE)
References
- https://packetstorm.news/files/id/180855
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/aux
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabili
- https://web.archive.org/web/20210123073627/https://www.limesurvey.org/blog/22-se
- https://www.vulncheck.com/advisories/limesurvey-unauthenticated-arbitrary-file-d
FAQ
What is CVE-2025-34120?
CVE-2025-34120 is a documented vulnerability. An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validate serialized input to the admin backup en...
How severe is CVE-2025-34120?
CVSS scoring is not yet available for CVE-2025-34120. Check NVD for updates.
Is there a patch for CVE-2025-34120?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.